System and methods using ephemeral accounts to protect user accounts with sensitive data

ABSTRACT

A plurality of virtual machines instances are instantiated and configured to use a subset of sensitive data to generate reports such that the reports can be visually inspected by authorized personnel or entities for potential abnormalities. After completion of the inspection, the virtual machine instances are then deleted such that the sensitive data that were used to generate the reports become inaccessible.

CROSS-REFERENCE TO RELATED APPLICATION

This application incorporates by reference for all purposes the fulldisclosure of co-pending U.S. patent application Ser. No. 16/562,347,filed concurrently herewith, entitled “SYSTEM AND METHODS USINGEPHEMERAL ACCOUNTS TO LIMIT RISK OF EXPOSING SENSITIVE DATA”.

BACKGROUND

In modern computing systems and environments, security for systems anddata is increasing in importance. In many computing environments, thetransfer of data between computing systems raises security concerns. Forexample, an individual might use a computing system with access tosensitive data to generate reports that then include the sensitive data,which could then be transmitted to another computing system andintentionally or unintentionally circumvent data loss preventionsystems. Accordingly, ensuring that other computing systems orunauthorized entities are unable to access the sensitive data ischallenging and can involve a significant amount of time and manuallabor.

BRIEF DESCRIPTION OF THE DRAWINGS

Various techniques will be described with reference to the drawings, inwhich:

FIG. 1 illustrates an environment between a computing device and using avirtual machine (VM) instance to generate reports, in accordance with atleast one embodiment;

FIG. 2 illustrates a use case diagram indicating the capabilities ofeach of the services associated with a VM instance to generate reports,in accordance with at least one embodiment;

FIG. 3 illustrates various planes/services of a VM instance, inaccordance with at least one embodiment;

FIG. 4 illustrates a diagram of the connections between the variouscomponents used with a VM instance to generate the reports, inaccordance with at least one embodiment;

FIG. 5 illustrates a process for sending a report to a reportingauthority, in accordance with at least one embodiment;

FIG. 6 illustrates an example process for using a VM instance togenerate a report and further sending the report to the reportingauthority, in accordance with at least one embodiment;

FIG. 7 illustrates an example process in which a VM instance is used foreach report until the report is successfully transmitted to thereporting authority, in accordance with at least one embodiment.

FIG. 8 illustrates an example diagram of a security plane associatedwith the VM instance, in accordance with at least one embodiment;

FIG. 9 illustrates an example process in which a plurality of VMinstances are instantiated to generate a report, in accordance with atleast one embodiment;

FIG. 10 illustrates an environment in which a VM instance is selectedfrom a plurality of VM instances to generate reports, in accordance withat least one embodiment; and

FIG. 11 illustrates a system in which various embodiments can beimplemented.

DETAILED DESCRIPTION

Techniques described and suggested herein include methods, systems, andprocesses for generating a report with content that satisfies variousreporting authority requirements while also limiting the exposure ofsensitive data. That is, in an effort to satisfy reporting requirementsfor different reporting authorities, a virtual machine instance(referred herein as “VM instance”) is instantiated with the necessaryinfrastructure, service, data, and connectivity to allow a customer in acomputing resource service provider environment to access sensitive dataand generate reports (e.g., suspicious activity reports) with the propercontent and further send these reports off to the reporting authority tosatisfy reporting requirements. After sending the reports, the VMinstance is then deleted so that all the information including thesensitive data used by the VM instance become inaccessible. Thus, the VMinstance is active for a limited amount of time that is proportional tothe time that it takes to generate the reports (e.g., completion time tosend the report). The VM instance, while active, has all the propercredentials to access a secure storage service in order to obtain allthe sensitive data necessary to satisfy the reporting requirements. TheVM instance may be limited to obtaining the sensitive data required forthe report and no additional data, so that exposure is limited andsensitive data that is not pertinent to the report is not accessedunnecessarily.

More specifically, in an example, a request to generate a report for aparticular reporting authority (e.g., government agency) is received byan application interface programming (API) gateway at a VM instanceoperating in a computing resource service provider environment. Therequest to generate the report can indicate information about theparticular reporting authority for which the report is going to begenerated. The workflow being performed can enable the VM instance toobtain access to the data needed to complete the report. The VM instancecan use the information from the request to identify what data needs tobe obtained, in what format the report (e.g., pipe-delimitated textfile) needs to be in, and other information pertinent to the reportingrequirements set forth by the particular reporting authority.Subsequently, the VM instance can then generate the report and transmitit to the proper reporting authority. Once the report is transmitted,the VM instance is deleted such that services and other systems in thecomputing resource service provider environment are unable to access anyof the information (e.g., data obtained by the VM instance) used togenerate the report.

In an embodiment, instances are instantiated and associated withaccounts associated with the customer. For example, in an embodiment, aVM instance is generated specifically to indicate account andtransaction records associated with a customer and thus, limiting theexposure of data to the VM instance. The VM instance may then determinewhether a suspicious activity has occurred in connection with theaccount with respect to the reporting authority's requirements. The VMinstance may then generate the report with all the data (some in cleartext form using a tokenization service) and suspicious activityinformation and send it to the proper reporting authority. The VMinstance may subsequently be deleted such that information and dataprocessed by the VM instance becomes inaccessible. In an embodiment, theVM instance can be instantiated along with a plurality of VM instancesto monitor multiple accounts and transaction records simultaneously ornear simultaneously, and each VM instance may be instantiated with thenecessary infrastructure and services that are needed to satisfyindividual reporting authorities.

Techniques described and suggested herein provide many technicaladvantages to the efficiency and security of transferring data in atechnical environment. In some embodiments, transactions with a customer(e.g., business entity or corporation) may involve sensitive data suchas bank account records and the customer may be required to generate asuspicious activity report about the transactions to satisfy variousgoverning entities and their requirements for reporting transactions.These transactions, sensitive data, and any additional information aboutthe transactions are typically stored in a physical secure storagefacility owned and operated by the customer. Since the reports containsensitive data, generating the reports require having access to thephysical secure storage facility. Typically, one or more physicalcomputing systems are inside a physical secure storage facility, andusers are able to use the one or more computing systems inside thefacility to obtain access to the sensitive data and generate reportsfrom that data. However, physically having a user or authorizedpersonnel go inside the storage facility just to upload reports can belabor intensive and inefficient.

The techniques described herein result in generating the reports using avirtual machine instance configured with the proper credentials toaccess the data from the secure storage facility and the virtual machineinstance is configured to be active only for the duration in timerelative to generating the report. The VM instance is used and providedwith the proper credentials to access the sensitive data in the securestorage facility without having to physically send a user to be presentin the secure storage facility. The VM instance then uses information togenerate the report and formats the report according to the requirementsof a reporting authority. The VM instance then is removed from theenvironment so that sensitive data that was used to generate the reportis not exposed outside of the VM instance, which thereby reduces therisk of the sensitive data being exposed. Moreover, by using the VMinstance, only data that is necessary for the report is used and thenremoved without exposing other sensitive data. That way, only thesensitive data necessary to generate the report is protected and thus,the system does not have to protect additional sensitive dataunnecessary to the report, which limits the exposure of sensitive data.

In the preceding and following description, various techniques aredescribed. For purposes of explanation, specific configurations anddetails are set forth in order to provide a thorough understanding ofpossible ways of implementing the techniques. However, it will also beapparent that the techniques described below may be practiced indifferent configurations without the specific details. Furthermore,well-known features may be omitted or simplified to avoid obscuring thetechniques being described.

FIG. 1 illustrates an example environment 100 where a report isgenerated using a virtual (VM) instance 112. A user device 102 mayconnect to a disclosure authority service 110 via a connection 104across a network 106. The user device 102 may be a remote VM instancerunning on one or more remote computer systems, or a software programthat runs on the user device 102. The user device 102 can be implementedwith a graphic user interface (GUI) that can obtain input from a user.The command or commands to connect to the host computer system (notdepicted in FIG. 1) can originate from an outside computer system and/orserver, or can originate from an entity, user or process on a remotenetwork location, or can originate from an entity, user or processwithin the computer system, or can originate from the user device 102,or can originate as a result of a combination of these and/or other suchentities.

The user device 102 can request connection to the host computer systemvia one or more connections 104 and, in some embodiments, via one ormore networks 106 and/or entities associated therewith, such as serversconnected to the network, either directly or indirectly. The user device102 can request access to the host computer system, which also includesa disclosure authority service 110 can be another computer system via anetwork, including at least servers, laptops, mobile devices such assmartphones or tablets, other smart devices such as smart watches, smarttelevisions, set-top boxes, video game consoles and other such networkenabled smart devices, distributed computing systems and componentsthereof, abstracted components such as guest computer systems or virtualmachines and/or other types of computing devices and/or components. Thenetwork 106 can include, for example, a local network, an internalnetwork, a public network such as the Internet, a wide-area network, awireless network, a mobile network, a satellite network, a distributedcomputing system with a plurality of network nodes, and/or the like. Thenetwork 106 can also operate in accordance with various protocols, suchas those listed below, Bluetooth, Wi-Fi, cellular network protocols,satellite network protocols and/or others.

The user device 102 may send a request access to the disclosureauthority service 110 within the environment 100 (the environment may bea distributed and/or virtualized datacenter) provided by a computingresource service provider. The computing resource provider can alsoprovide access to one or more computer services such as additionalvirtual machine instances, automatic scaling groups, file-based databasestorage systems, block storage services, redundant data storageservices, data archive services, data warehousing services, user accessmanagement services, content management services and/or other suchcomputer system services as can be running thereon. The computingresource service provider can also provide access to computer systemresources such as user resources, policy resources, network resourcesand/or storage resources. In some distributed and/or virtualizedcomputer system environments, the resources associated with the computerservices can be physical devices, virtual devices, combinations ofphysical and/or virtual devices or other such device embodiments. Insome embodiments, the one or more host machines can be physical machineslocated within the computer system environment.

The user device 102 can request to generate a report (e.g., suspicioustransaction record, or suspicious activity report) to satisfy one ormore reporting requirements associated with a reporting authority 114.The reporting authority 114 may be, for example, an entity that helpsidentify potential fraudulent transactions. The disclosure authorityservice 110 (e.g., a service that is capable of receiving messages orrequests from a user device 102) receives the request and sends aninstruction, message, or another request to a VM instance 112 that isrunning on the host computer system also operating within the computingresource service provider. The VM instance 112 can be one of one or moreVM instances running on the host computer system. The VM instance 112may also be referred herein as simply an instance, virtual machineinstance, or virtual instance.

When a VM instance 112 is identified that it can be used to generate thereport, the VM instance 112 may use information from the request thatoriginated from the user device 102, which includes all the details toconstruct the report to the reporting authority 114 (including subject,body, attachment file name, and attachment file content already in theformat required by the reporting authority 114). In some embodiments,the report is sent as an email. In an embodiment, the VM instance 112responds to the disclosure authority service 110 immediately with anAccepted response and creates a transmission workflow to transmit thereport to the reporting authority 114. As part of the response, the VMinstance 112 also includes a task identifier (e.g., task ID) for thedisclosure authority service 110 so that the disclosure authorityservice 110 can use it in the future to query the transmission status.In embodiment, the VM instance's 114 workflow transforms the attachmentfile content by replacing the tokens with clear text of the sensitivedata (e.g., data that is characterized by the user device 102 assensitive), and creates the report to the reporting authority 114, in aparticular format required by the reporting authority 114. The reportmay be signed with a private key (where the corresponding public key isshared with the reporting authority 114) and encrypted with a sharedpublic key also shared between the VM instance 112 and the reportingauthority 114. The encrypted report may then be sent in an email via asecure email service (SES) from the VM instance 112 to the reportingauthority 114. In an embodiment, the VM instance 112 transmits thereport to the reporting authority's 114 mail server with Simple MailTransfer Protocol (SMTP) over Transport Layer Security (TLS). In anembodiment, the VM instance 112 then marks the transmission task ascompleted successfully. The disclosure authority service 110 may querythe VM instance 112 with the previously obtained task ID, and the VMinstance 112 may respond with a status of Completed.

FIG. 2 illustrates a use case diagram 200 indicating the capabilities ofeach of the services associated with a VM instance 208 to generatereports, in accordance with at least one embodiment. In an embodiment, areporting authority 202 is an entity that has the capability to sendmessages to a customer to indicate that the customer send reports (e.g.,suspicious activity reports) back to the reporting authority 202. Themessages may include the format of the reports, what content needs to bein the reports, and additional requirements that the customer may needto satisfy to generate the proper report. In an embodiment, the customermay be a business entity, company, corporation, and the like. Thecustomer may operate a business where transactions are made and dataassociated with these transactions are recorded and stored within thecustomer's databases and/or storage devices. The customer may instruct adisclosure authority service 204 that is associated with a VM instance208 to generate the proper reports for the reporting authority 202 afterreceiving a request from the reporting authority 202. In an embodiment,the disclosure authority service 204 has capabilities to send reportsusing the VM instance 208, retrieve receipts associated withsuccessfully transmitting the reports using the VM instance 208, and/ordelete the receipts. In an embodiment, the VM instance 208 uses a secureemail service (SES) 206 to receive messages from the reporting authority202, sending reports to the reporting authority 202, inform thedisclosure authority service 204 about the status of sending the reportsand/or delete messages obtained from the reporting authority 202. In anembodiment, the SES 206 is configured as a service that sends andreceives messages such as emails from the reporting authority 202.

FIG. 3 illustrates various planes/services of a VM instance 300, inaccordance with at least one embodiment. In an embodiment, the customercan elect to obtain a VM instance 300 for the purposes of generating thereport and deleting the VM instance 300 after the report is generated.Thus, the VM instance 300 may be limited to a one-time use. In anembodiment, the VM instance 300 is configured with infrastructure,service, data, and connectivity for the customer to have in order to allthe necessities to generate the report for the customer to satisfy thereporting requirements. The reporting requirements can vary fromreporting authority to reporting authority and thus, it may bebeneficial that the VM instance 300 be configured with the properinfrastructure to perform the operations to satisfy the reportingrequirements for various reporting authorities. In an embodiment, the VMinstance 300 is referred to as an ephemeral infrastructure. To limitapplication vulnerability exposure and blast radius and to maintain goodseparation of responsibilities of owners, the VM instance 300 issegregated into multiple distinct services/accounts.

In an embodiment, the VM instance 300 includes a data plane 302, acontrol plane 304, a security plane 306, and an audit logging plane 308.The data plane 302, for instance, includes a data plane member 310(e.g., data plane account) and a secure email service (SES) 312 thathosts the data processing service that implements API calls to securelytransmit messages that may contain sensitive data (e.g., transactionaldata, payment critical data). In an embodiment, the data plane member310 is configured for hosting the services that implement the API.Within the data plane 302 illustrated in FIG. 3, the VM instance 300 isfurther divided into five microservices with distinct roles andresponsibility (which is described in more detail with respect to FIG. 4below). In an embodiment, the control plane 304 includes a control planemember 314. In an embodiment, the security plane 306 includes a securityplane member 316. The security plane member 316 may be configured tohost detective controls over data plane accounts. In some instances, thesecurity plane 306 may referred to as the monitoring plane (which isdescribed in more detail with respect to FIG. 8 below). In anembodiment, the VM instance 300 also includes an audit logging plane 308with an audit logging plane member 318. The audit logging plane 308 maybe configured to log the events of the VM instance 300 such asinformation related to report generation and the contents of the report.That is, the audit logging plane member 318 may be configured forarchiving application, operating system (OS), and account logs forauditing purposes. Moreover, compliance offices may have internal orexternal compliance officers will audit the VM instance 300 to ensurethat it meets all applicable handling standards, and the standard forbuilding system that meet the requirements for processing sensitive data(e.g., restricted, critical, and/or payment critical data) as specifiedby the a data protection model.

In an embodiment, the VM instance 300 has a connection with the storagedevice via a direct connect. The storage device as described herein maybe a database or the like that stores records of the sensitive data. Forexample, each business entity may have a storage device that is adatabase containing records where all financial transactions that thebusiness entity has processed are logged and stored. In an embodiment,the storage device 320 may also be referred to as a payment secure zoneor a secure storage device. The VM instance 300 may have the appropriatecredentials and have the necessary infrastructure to obtain sensitivedata for reporting purposes. In an embodiment, the VM instance 300 alsohas an operation account associated with it. The operation account 322may be configured for hosting the logs for viewing and analysis, andoperation tools, including metrics, alarms, and dashboards. In anembodiment, the domain name server (DNS) holding account 324 is alsoassociated with the VM instance 300 and configured for managing domainnames.

In an embodiment, the data plane member 310 may be created anew everytime when a transmission is needed, and then deleted once thetransmission completes. All the credentials, keys, certificates, andresources used in this data plane member account are created every timea new account is created, with the exception of the public-private keypairs used to sign and encrypt the reports, which are stored using astorage service associated with the data plane 302.

FIG. 4 illustrates a diagram 400 of the connections between the variouscomponents used with a VM instance to generate the reports, inaccordance with at least one embodiment. The data plane of the VMinstance 402 and its connections are described in more detail here withrespect to FIG. 4. The data plane of the VM instance 402 may beconfigured to implement the APIs for transmitting and receivingmessages.

In an embodiment, the data plane of the VM instance 402 comprises atleast a plurality of micro services, which may include: 1) a gatewaysubnet 410, which is a micro service that accepts API calls forwardedfrom an API gateway of a disclosure authority service 404 that is a partof the computing resource service provider and calls the workflowservice in the workflow subnet 424 that implements the API. In anembodiment, the gateway subnet 410 is associated with a database 420that has access to obtain data and/or sensitive data used to generatereports; 2) a workflow subnet 424 associated with a VM instance workflowis a micro service that implements the workflow logic of the APIs; 3) atransformer-privileged subnet 426 that prepares the data fortransmission. This micro service has access to APIs associated with atokenization service to convert tokens to clear text critical data. Thisis only called by the workflow subnet 424 micro service to limit itsexposure to threats; 4) a transformer-non-privileged subnet 428 thatdeals with use cases where no access to the tokenization service isrequired. In some use cases, the incoming email messages from reportingauthority 406 go through the transformer-non-privileged subnet 428 to bedecrypted and verified; 5) another gateway subset 422, which is a microservice that transmits data prepared by the transformer-privilegedsubset 426 to specified endpoints. In an embodiment, the data plane ofVM instance 402 may also communicate with the security plane 432,operation plane, and the audit logging plane 436 as described withrespect to FIG. 3. In an embodiment, communication between API gatewayand the data plane of VM instance 402 along with communication amongdata plane micro services may use TLS mutual authentication.

FIG. 5 illustrates a process 500 for sending a report to a reportingauthority, in accordance with at least one embodiment. In an embodiment,a disclosure authority service 502 sends 522 a message to a VM instancevia a VM gateway 504. The message may specify all the details ofconstructing the report to the reporting authority 520 includingsubject, body, attachment file name, and attachment file content alreadyin the format (e.g., pipe-delimited text containing tokens) as requiredby the reporting authority 520. The message may be transmitted withtokens. The VM gateway 504 verifies that the message is legitimate 524and responds 528 to the disclosure authority service 502 with anAccepted response 528 and creates a task 526 for a transmission workflowto transmit a report to reporting authority 520. The VM gateway 504transmits the task 532 to VM workflow 508. The obtained tokens are thensent 530 to a storage device 516 that is associated with a tokenizationservice. The VM workflow 508 sends a message 536 to VM control 510. TheVM workflow 508 may send a transform request 538 to the VMtransformation-privileged service 512. The VM transformation-privilegedservice 512 sends a request 540 to the tokenization service 514 to getthe tokens replaced for clear text form data. The access to data may betime-based. That is, there may be access control policies associatedwith the data that indicate the amount of time that data can be obtainedusing the tokens. In some instances, data can be obtained using tokensso long as the VM instance is still executing (e.g., within the lifespanof the VM instance). The clear text form data may be encrypted using theVM instance's key such that the clear text form data is not exposedwhile being transported from the tokenization service 514 to the VMinstance. The VM transformation-privileged service 512 sends thegenerated report 542 with sensitive data (some in clear text form) tothe VM gateway 518. In some instances, the entirety of generated reportmay be encrypted to meet the requirements of the reporting authority520. In other instances, just the sensitive data is encrypted in thegenerated report. The VM gateway 518 may then send a GET request 544 forend point configuration. The VM gateway 518 may then send the report 548in email form to the reporting authority 520. The VM workflow 508 mayupdate 550 the task status as completed and inform the database 506.

In an embodiment, the VM instance's workflow 508 transforms the message(e.g., attachment file content) from the disclosure authority service502 by replacing the tokens with clear text data, and creates the reportto the reporting authority in Secure/Multipurpose Internet MailExtensions (S/MIME) format, signed with private key of the system andencrypted with public key of the reporting authority. The VM instancetransmits the report in email form to reporting authority's mail serverwith SMTP over TLS. The VM workflow 508 mark the transmission task ascompleted 550 successfully and the disclosure authority service 502 mayquery the VM instance with task identifier (e.g., task query request)and responds with a message, notification, or status of Completed.

In another embodiment, the reporting authority 520 can send messages tothe customer via a disclosure authority service 502. This may beperformed by sending an email to an address associated with a customeror an entity. This email may be subsequently received by the customer'ssecure email service (SES). The email may be signed with the reportingauthority's key and encrypted with a key shared with the customer. In anembodiment, the disclosure authority service 502 calls using an API tothe VM instance to check available messages on the preconfiguredend-point. The VM instance checks configured storage areas that the SESdeposit incoming emails addressed to the customer. The VM instancereturns the list of available messages, each with an identifier to thedisclosure authority service 502. The disclosure authority service 502receives the list of messages. The disclosure authority service 502submits an API call to the VM instance with a message identifier tofetch the content of the message. This part of can repeat for all themessages that disclosure authority service 502 wants to retrieve. The VMinstance retrieves the message from the storage area that SES has forthe customer's email address. The VM instance may decrypt the messagewith its key and verify the reporting authority's signature with theshared key with the reporting authority 520. The VM instance may verifythat the message does not contain payment critical data and returns themessage with the reporting authority's signature to the disclosureauthority service 502.

In yet another embodiment, the disclosure authority service 502 findsthat all messages have been read before and there is no need to retrieveany of the messages in the list and thereby may end its search. In anembodiment, the VM instance fails to retrieve the message and returns afailed status to the disclosure authority service 502 and the processmay then terminate at this point. In an embodiment, the VM instancefails to decrypt the email, or fails to verify reporting authority's 520signature and returns a failed status to the disclosure authorityservice 502 and then at this point may also terminate. In yet anotherembodiment, the VM instance may detect a presence of payment criticaldata in the message and return a failed status to the disclosureauthority service 502. The VM instance may send an alarm for thissecurity incident, start the security incident response process, andthen terminate.

FIG. 6 illustrates an example process 600 for using a VM instance togenerate a report and further send the report to the reportingauthority, in accordance with at least one embodiment. In an embodiment,process 600 describes satisfying reporting requirements for a reportingauthority using a virtual computing environment. A customer (e.g., user,business owner, business entity) in a computing resource serviceprovider environment may have to report transaction records, deals,financial irregularities, and the like to a reporting authority. Eachreporting authority may have its own reporting requirements that thecustomer must follow. In an embodiment, a customer, via a disclosureauthority service associated with the customer may receive a requestfrom the reporting authority. In an alternate embodiment, the requestmay initiate from the customer and not the reporting authority. Therequest may cause the disclosure authority service to associate with avirtual machine (VM) instance from a plurality of VM instances. The VMinstance may receive the request from the disclosure authority serviceto generate a report for a destination (e.g., an entity external to thesystem) 602. The VM instance may be tailored with the necessaryinfrastructure, services, and/or configurations to satisfy the request.In an example, the request may indicate information to satisfy thereporting requirements fully, such as the type of format the report mustfollow, the content of the report, and the like. The VM instance is thenconfigured with the necessary infrastructure to satisfy the reportingrequirements. In an alternate embodiment, the disclosure authorityservice sends a request to instantiate a new VM instance to perform theprocess 600 instead of associating with a previously instantiated VMinstance.

In an embodiment, the VM instance, based on its configurations with theproper credentials, receives data comprising one or more tokens from adatabase (e.g., storage device) 604. The data may be sensitive data thatincludes sensitive information associated with a plurality ofindividuals or companies. The data obtained may only be data that isnecessary to satisfy the reporting requirements and nothing more fromthe database so that exposure is limited. In an embodiment, the VMinstance may identify, based on the request, a format for the report606. In an embodiment, information to fully satisfy the reportingrequirements may indicate that the type of content in the report mustinclude all the account numbers that have been made a transaction on thecustomer's online store in the past year. Hence, the data obtained fromthe database would just be a subset of the data that include the accountnumbers, and no other data. This way, exposure of sensitive data islimited and other types of sensitive data are not exposed for processingwhen not needed: In addition, by only obtaining a subset of the data,computing resources may be conserved since the VM instance is performingoperations using just a subset of the data and not all the data from thedatabase, for example. In some embodiments, the subset of data obtainedfrom the database include one or more tokens. The VM instance may thenforward the one or more tokens to a tokenization service to obtain thedata in clear text form 608. The tokenization service may includemapping information such that it identifies the location of data inclear text form based on information from the one or more tokens.

In an embodiment, the report is then generated by the VM instance 610with the obtained data along with some of the data in clear text form.The report may be sent over email from the VM instance's secure emailservice to the reporting authority and thus, satisfying the reportingrequirements of the reporting authority 612. The report may be encryptedprior to submission. The VM instance 610 may then be removed or deleted614 from the computing resource service provider environment such thatany data that was obtained during process 600 is inaccessible outside ofthe environment. In an embodiment, data obtained during process 600become inaccessible when encryption keys associated with the data aredeleted. That is, encryption keys used to encrypt data may be deleted asa way of deleting or causing the data obtained during process 600 to beinaccessible. In an embodiment, the VM instance 610 and all of its dataare deleted when an unexpected event occurs and not necessarily deletedonly after submission of a report as indicated above. In some instances,there may be an anomaly detection mechanism or a set of conditionsdirected to monitoring the VM instance for anomalies. If an anomaly isdetected, the VM instance may be terminated instantly.

FIG. 7 illustrates an example process 700 in which a VM instance is usedfor each report until the report is successfully transmitted to thereporting authority, in accordance with at least one embodiment. In anembodiment, the disclosure authority service queries the VM instancewith a message with a task identifier before VM instance completes thetransmission. At 704, a determine is made whether the VM instance failsto transform the attachment file content due to erroneous content,non-existing tokens, tokenization service failures, or other failures.If a send was successful, the task is marked as complete and the reportis sent to the reporting authority 706. If the send is not successful,the VM instance records the task status as Failed Transformation. In anembodiment, disclosure authority service queries the VM instance withtask identifier and VM instance responds with a status of FailedTransformation and the operations may terminate. In an embodiment, thereport fails to transmit the reporting authority's mail server. The VMinstance may retry for the preconfigured or predetermined maximumretries 708 from the end-point configuration and succeeds. The VMinstance marks the transmission task as completed successfully and taskis completed 712. The VM instance retries for the preconfigured maximumretries from the end-point configuration and fails then the VM instancerecords the task status as Failed Transmission and it terminates 714. Inan embodiment, a new VM instance is used and active for an amount oftime proportional to the time the report is generated and sent off tothe reporting authority.

FIG. 8 illustrates an example diagram of the security plane 802associated with the VM instance 800, in accordance with at least oneembodiment. The security plane (e.g., security detection plane) 802comprises a security plane member (e.g., security plane account member)804 and comprises detective controls based on log streams from otherplanes. The audit logging plane (not depicted here in FIG. 8 butdepicted in other FIGs in the detailed description) saves copies ofpristine and immutable logs from other planes for auditing and forensicspurposes. In an embodiment, the ownership of security plane 802 includesowing 1) the code for the detective controls, which include both thecode and the infrastructure that the code runs on; 2) ContinuousIntegration/Continuous Deployment (CI/CD) pipelines for building,testing and deploying the controls; 3) incident response processes andtools to handle alarms filed by the controls; 4) monitors and dashboardsfor the health of the controls, including in-prod testing of thecontrols; 5) security operation reviews with weekly cadence and withoperation report decks.

In an embodiment, owning the code for the detective controls entailsowning the control code packages independent of the VM instance. In thean exemplary stack, the code for the detective controls may be code inan event-driven and sever less computing system associated with the VMinstance application package and the cloud formation templates in the VMinstance software tools package. The code may need to be broken out intonew packages owned by a payment security team.

In an embodiment, owning the CI/CD pipelines entails owning the build,testing, and deployment pipeline that deploys the control code to thesecurity detection plane. The application of the VM instance constructsa custom pipeline due to security constraints. A payment security teamcan and should evaluate the security requirements of the detectivecontrols and make independent technology decisions.

In an embodiment, owning the incident response processes and toolsentails owning the tools to handle alarms (tickets) filed by thecontrols. In an embodiment, owning the monitors of the health of thecontrols entails having proper metrics and alarms for the health of thecontrols. The security requirements of no console access and no hostaccess means that logs and metrics of the security detection planeaccounts may be channeled to a security operation account (differentfrom the VM instance operation account) for log view, dashboards, andalarms. In an embodiment, automated and/or regular manual in-prodtesting should be conducted to ensure that the controls work over time,even if there is a lack of real triggering events. In an embodiment,owning the security operation reviews entails the establishment of aregular (weekly) cadence of security operation review. This review willbe supported by an operation deck that includes aggregate of present andhistorical metrics generated by the detective controls, the monitors ofthe detective controls, and the artifacts generated by the operations(alarms, tickets, etc.).

FIG. 9 illustrates an example process in which a plurality of VMinstances are instantiated and used to identify activities to generate areport, in accordance with at least one embodiment. In an embodiment, adisclosure authority service associated with a customer in a computingresource service provider environment may obtain a request to satisfyreporting requirements for a reporting authority. In an embodiment, thedisclosure authority service may forward the request to a VM instancemay receive a request to monitor one or more accounts comprisingsensitive data, wherein the one or more accounts are associated with acustomer of a computing resource service provider 902. In an embodiment,the VM instance may select another VM instance from a plurality of VMinstances to monitor the one or more accounts 904. This selected VMinstance is selected and configured with the necessary infrastructureand services to monitor the one or more accounts that satisfy thereporting requirements for a particular reporting authority. In anembodiment, this selected VM instance may monitor and identify anabnormality (e.g., suspicious activity) with transactions associatedwith the one or more accounts 906. In an embodiment, the suspiciousactivity may include a non-limiting example of identifying that one ormore fraudulent purchases are being made on the customer's accounts. Inan embodiment, this selected VM instance may detect that the transactionrecords associated with the suspicious activity include sensitive dataand a subset of the sensitive data comprises tokens. This selected VMinstance may then provide the subset of the sensitive data, based onidentifying the abnormality, to a service (e.g., tokenization service)in exchange for the subset of the sensitive data in clear text form 908.In an embodiment, this selected VM instance generate a report (e.g.,suspicious activity report) to allow for visual inspection of what iscaptured in the report, wherein the report includes informationindicating the abnormality with the transactions, the sensitive data,and the subset of sensitive data in clear text form 910. That is, in anembodiment, a generated report with suspicious activity is queried(e.g., inspected). A user or an entity may query the report to detectsuspicious activity or transactions associated with a destination (e.g.,user account, merchant's website). In an embodiment, this VM instance isthen deleted in response to completing the visual inspection 912 suchthat any data or information processed by this VM instance is notexposed.

FIG. 10 illustrates an environment 1000 in which a VM instance 1012 isselected from a plurality of VM instances 1008 to monitor transactionsassociated with a customer's account to generate reports, in accordancewith at least one embodiment. In an embodiment, a user device 1002(controlled by a customer) sends a request 1004 to monitor one or moreaccounts associated with the customer via a network 1006. The requestmay be received by a disclosure authority service 1010, which then mayforward the request to cause VM instance 1012 to be selected. That is,in an embodiment, a VM instance 1012 may be selected to specificallymonitor account and transaction records associated with a customer andthus, limiting the exposure of the VM instance 1012 to just the dataassociated with the monitoring. The VM instance may be selected from aplurality of VM instances 1008. The VM instance 1012 may then determinewhether a suspicious activity has occurred with respect to the reportingauthority's requirements. The VM instance 1012 may then generate thereport with all the data (some in clear text form using a tokenizationservice associated with a storage device 1016) and suspicious activityinformation and send to the proper reporting authority 1014. The VMinstance 1012 may be subsequently be deleted such that information anddata processed by the VM instance 1012 becomes inaccessible. In anembodiment, the VM instance 1012 can be instantiated along with aplurality of VM instances 1008 to monitor multiple accounts andtransaction records simultaneously or near simultaneously, and each VMinstance may be instantiated with the necessary infrastructure andservices that are needed to satisfy reporting requirements 1018 for eachindividual reporting authorities. In an embodiment, a second virtualmachine instance may be instantiated to monitor a subset of thetransaction records for the account associated with the customer togenerate a second report while the first virtual machine instancemonitors the account. For example, based on monitoring the account usingthe first VM instance, a certain bank account number is fraudulent, sothe second VM instance is just spun up to monitor any transactionsregarding the bank account and generate reports for that.

FIG. 11 illustrates aspects of an example system 1100 for implementingaspects in accordance with an embodiment. As will be appreciated,although a web-based system is used for purposes of explanation,different systems may be used, as appropriate, to implement variousembodiments. In an embodiment, the system includes an electronic clientdevice 1102, which includes any appropriate device operable to sendand/or receive requests, messages, or information over an appropriatenetwork 1104 and convey information back to a user of the device.Examples of such client devices include personal computers, cellular orother mobile phones, handheld messaging devices, laptop computers,tablet computers, set-top boxes, personal data assistants, embeddedcomputer systems, electronic book readers, and the like. In anembodiment, the network includes any appropriate network, including anintranet, the Internet, a cellular network, a local area network, asatellite network or any other such network and/or combination thereof,and components used for such a system depend at least in part upon thetype of network and/or system selected. Many protocols and componentsfor communicating via such a network are well known and will not bediscussed herein in detail. In an embodiment, communication over thenetwork is enabled by wired and/or wireless connections and combinationsthereof. In an embodiment, the network includes the Internet and/orother publicly addressable communications network, as the systemincludes a web server 1106 for receiving requests and serving content inresponse thereto, although for other networks an alternative deviceserving a similar purpose could be used as would be apparent to one ofordinary skill in the art.

In an embodiment, the illustrative system includes at least oneapplication server 1108 and a data store 1110, and it should beunderstood that there can be several application servers, layers orother elements, processes or components, which may be chained orotherwise configured, which can interact to perform tasks such asobtaining data from an appropriate data store. Servers, in anembodiment, are implemented as hardware devices, virtual computersystems, programming modules being executed on a computer system, and/orother devices configured with hardware and/or software to receive andrespond to communications (e.g., web service application programminginterface (API) requests) over a network. As used herein, unlessotherwise stated or clear from context, the term “data store” refers toany device or combination of devices capable of storing, accessing andretrieving data, which may include any combination and number of dataservers, databases, data storage devices and data storage media, in anystandard, distributed, virtual or clustered system. Data stores, in anembodiment, communicate with block-level and/or object-level interfaces.The application server can include any appropriate hardware, softwareand firmware for integrating with the data store as needed to executeaspects of one or more applications for the client device, handling someor all of the data access and business logic for an application.

In an embodiment, the application server provides access controlservices in cooperation with the data store and generates contentincluding but not limited to text, graphics, audio, video and/or othercontent that is provided to a user associated with the client device bythe web server in the form of HyperText Markup Language (“HTML”),Extensible Markup Language (“XML”), JavaScript, Cascading Style Sheets(“CSS”), JavaScript Object Notation (JSON), and/or another appropriateclient-side or other structured language. Content transferred to aclient device, in an embodiment, is processed by the client device toprovide the content in one or more forms including but not limited toforms that are perceptible to the user audibly, visually and/or throughother senses. The handling of all requests and responses, as well as thedelivery of content between the client device 1102 and the applicationserver 1108, in an embodiment, is handled by the web server using PHP:Hypertext Preprocessor (“PHP”), Python, Ruby, Perl, Java, HTML, XML,JSON, and/or another appropriate server-side structured language in thisexample. In an embodiment, operations described herein as beingperformed by a single device are performed collectively by multipledevices that form a distributed and/or virtual system.

The data store 1110, in an embodiment, includes several separate datatables, databases, data documents, dynamic data storage schemes and/orother data storage mechanisms and media for storing data relating to aparticular aspect of the present disclosure. In an embodiment, the datastore illustrated includes mechanisms for storing production data 1112and user information 1116, which are used to serve content for theproduction side. The data store also is shown to include a mechanism forstoring log data 1114, which is used, in an embodiment, for reporting,computing resource management, analysis or other such purposes. In anembodiment, other aspects such as page image information and accessrights information (e.g., access control policies or other encodings ofpermissions) are stored in the data store in any of the above listedmechanisms as appropriate or in additional mechanisms in the data store1110.

The data store 1110, in an embodiment, is operable, through logicassociated therewith, to receive instructions from the applicationserver 1108 and obtain, update or otherwise process data in responsethereto, and the application server 1108 provides static, dynamic, or acombination of static and dynamic data in response to the receivedinstructions. In an embodiment, dynamic data, such as data used in weblogs (blogs), shopping applications, news services, and other suchapplications, are generated by server-side structured languages asdescribed herein or are provided by a content management system (“CMS”)operating on or under the control of the application server. In anembodiment, a user, through a device operated by the user, submits asearch request for a certain type of item. In this example, the datastore accesses the user information to verify the identity of the user,accesses the catalog detail information to obtain information aboutitems of that type, and returns the information to the user, such as ina results listing on a web page that the user views via a browser on theuser device 1102. Continuing with this example, information for aparticular item of interest is viewed in a dedicated page or window ofthe browser. It should be noted, however, that embodiments of thepresent disclosure are not necessarily limited to the context of webpages, but are more generally applicable to processing requests ingeneral, where the requests are not necessarily requests for content.Example requests include requests to manage and/or interact withcomputing resources hosted by the system 1100 and/or another system,such as for launching, terminating, deleting, modifying, reading, and/orotherwise accessing such computing resources.

In an embodiment, each server typically includes an operating systemthat provides executable program instructions for the generaladministration and operation of that server and includes acomputer-readable storage medium (e.g., a hard disk, random accessmemory, read only memory, etc.) storing instructions that, if executedby a processor of the server, cause or otherwise allow the server toperform its intended functions (e.g., the functions are performed as aresult of one or more processors of the server executing instructionsstored on a computer-readable storage medium).

The system 1100, in an embodiment, is a distributed and/or virtualcomputing system utilizing several computer systems and components thatare interconnected via communication links (e.g., transmission controlprotocol (TCP) connections and/or transport layer security (TLS) orother cryptographically protected communication sessions), using one ormore computer networks or direct connections. However, it will beappreciated by those of ordinary skill in the art that such a systemcould operate in a system having fewer or a greater number of componentsthan are illustrated in FIG. 11. Thus, the depiction of the system 1100in FIG. 11 should be taken as being illustrative in nature and notlimiting to the scope of the disclosure.

Embodiments of the disclosure can be described in view of the followingclauses:

1. A computer-implemented method, comprising:

receiving a request, at an instantiated virtual machine instance, togenerate a report for a destination;

receiving, based at least in part on credentials associated with therequest, data from a storage location comprising one or more tokens,wherein the credentials associated with the request provides the virtualmachine instance with information usable to access the data from thestorage location;

identifying, based at least in part on the request, a format of thereport comprising the data;

causing, by providing the one or more tokens to a service, the serviceto provide a subset of the data to be in clear text form;

using the virtual machine instance to generate the report, according tothe format of the report, to include the data and the subset of the datain clear text form;

sending the report to the destination; and

deleting the virtual machine instance in response to sending the reportto the destination.

2. The computer-implemented method of clause 1, further comprisingdeleting the virtual machine instance in response to sending the reportto the destination such that data included in the report is inaccessibleoutside of the virtual machine instance.

3. The computer-implemented method of clauses 1 or 2, wherein the formatof the report is based at least in part on specifications associatedwith the destination, and wherein the format of the report includesinformation indicative on how to format at least one of: a subjectheader, body, file name, or content.

4. The computer-implemented method of any of clauses 1 to 3, whereinproviding the one or more tokens to a service further comprises sendingthe one or more tokens to a tokenization service associated with thestorage location, wherein access to the tokenization service is based atleast in part on using the same credentials used to obtain access to thestorage location.

5. The computer-implemented method of any of clauses 1 to 4, wherein thevirtual machine instance uses only the data and the subset of the datain clear text form and no other data from the storage location togenerate the report such that exposure is limited to only the data andthe subset of the data in clear text form.

6. The computer-implemented method of any of clauses 1 to 5, furthercomprising determining whether an anomaly event has occurred duringexecution of the virtual machine instance and deleting the virtualmachine instance in response to the determination that the anomaly eventhas occurred.

7. A system, comprising:

at least one computing device configured to implement one or moreservices, wherein the one or more services:

-   -   obtain a request to generate a report for a destination with        content that satisfies a set of conditions associated with the        destination;    -   use credentials associated with the request to obtain data        comprising one or more identifiers for sensitive data from a        storage device;    -   obtain the sensitive data as a result of transmitting the one or        more identifiers to a service associated with the storage        device;    -   generate, based at least in part on the set of conditions, the        report with content to include the data and sensitive data; and    -   satisfy the request by transmitting the report to the        destination.

8. The system of clause 8, wherein the data and the sensitive dataincluded in the report are inaccessible outside of the system.

9. The system of any of clauses 7 or 8, wherein the set of conditionsincludes information indicating a type of content to be included in thereport and format requirements for the report.

10. The system of any of clauses 7 to 9, wherein the service associatedwith the storage device is a tokenization service configured to replaceone or more identifiers for sensitive data with the sensitive data,wherein the tokenization services includes a mapping of the one or moreidentifiers to storage locations of the sensitive data.

11. The system of any of clauses 7 to 10, wherein the request includesinformation indicative of a type of data to obtain from the storagedevice without exposing remaining data stored in the storage device.

12. The system of any of clauses 7 to 11, wherein the one or moreservices further sign the report with a private key associated with thesystem and encrypting the report with a public key associated with thedestination.

13. The system of any of clauses 7 to 12, wherein the one or moreservices in response to obtaining the request to generate the report,generate a task identifier useable for other systems to query atransmission status of the report to the destination.

14. The system of any of clauses 7 to 13, wherein the sensitive dataincludes at least data associated with transaction records associatedwith a website.

15. A non-transitory computer-readable storage medium storing thereonexecutable instructions that, as a result of being executed by one ormore processors of a computer system, cause the computer system to atleast:

obtain a request to generate a report for a destination with contentthat satisfies a set of conditions associated with the destination;

use credentials associated with the request to obtain data comprisingone or more identifiers for sensitive data from a storage device;

obtain the sensitive data as a result of transmitting the one or moreidentifiers to a service associated with the storage device;

generate, based at least in part on the set of conditions, the reportwith content to include the data and sensitive data; and

satisfy the request by transmitting the report to the destination.

16. The non-transitory computer-readable storage medium of clause 15,wherein the computer system is a virtual machine instance operating in avirtualized environment.

17. The non-transitory computer-readable storage medium of any ofclauses 15 or 16, wherein the data and the sensitive data included inthe report are inaccessible outside of the virtual machine instance.

18. The non-transitory computer-readable storage medium of any ofclauses 15 to 17, wherein the set of conditions include informationindicating a type of content to be included in the report and formatrequirements for the report.

19. The non-transitory computer-readable storage medium of any ofclauses 15 to 18, wherein the service associated with the storage deviceis a tokenization service configured to replace one or more identifiersfor sensitive data with the sensitive data.

20. The non-transitory computer-readable storage medium of any ofclauses 15 to 19, wherein the request includes information indicative ofa type of data to obtain from the storage device without exposingremaining data stored in the storage device.

21. The non-transitory computer-readable storage medium of any ofclauses 15 to 20, wherein in response to obtaining the request togenerate the report, generate a task identifier useable for othersystems to query a transmission status of the report to the destination.

22. The non-transitory computer-readable storage medium of any ofclauses 15 to 21, wherein the instructions further comprise instructionsthat, as a result of being executed by the one or more processors, causethe computer system to encrypt the report, prior to transmission, usingkeys associated with the destination.

23. A computer-implemented method, comprising:

receiving a request to identify one or more accounts comprisingsensitive data, wherein the one or more accounts are associated with acustomer of a computing resource service provider;

selecting a virtual machine instance to obtain information from the oneor more accounts;

identifying an abnormality with transactions associated with the one ormore accounts;

providing a subset of the sensitive data, as a result of identifying theabnormality, to a service in exchange for the subset of the sensitivedata in clear text form;

using the virtual machine instance to generate a report to allow forvisual inspection by an entity, wherein the report includes informationindicating the abnormality with the transactions, the sensitive data,and the subset of the sensitive data in clear text form; and deletingthe virtual machine instance in response to completing the visualinspection.

24. The computer-implemented method of clause 23, wherein the virtualmachine instance is selected, by the entity, from a pool of virtualmachine instances.

25. The computer-implemented method of any of clauses 23 or 24, whereinthe virtual machine instance remains active for an amount of time thatis proportional to a completion time of inspecting the report.

26. The computer-implemented method of any of clauses 23 to 25, whereinidentifying an abnormality with transactions associated with the one ormore accounts further comprises monitoring a website for transactionrecords associated with the website.

27. A system, comprising: at least one computing device configured toimplement one or more services, wherein the one or more services:

instantiate a virtual machine instance to satisfy a request to query areport including suspicious activity associated with a destination;

use the virtual machine instance to identify transaction records for anaccount associated with a customer;

determine whether an activity in the transaction records satisfy a setof conditions associated with the destination;

obtain sensitive data associated with the activity in clear text form;and

generate the report to include the activity comprising the sensitivedata in clear text form.

28. The system of clause 27, wherein the virtual machine instance isinstantiated with infrastructure and services to satisfy the request toquery the report.

29. The system of any of clauses 27 or 28, wherein the virtual machineinstance monitors transaction records specific to the customer such thatexposure is limited to the transaction records.

30. The system of any of clauses 27 to 29, wherein the at least onecomputing device configured to implement one or more services, furthercomprises: sending the report to the destination to after querying thereport for suspicious activity; and deleting the virtual machineinstance after sending the report to ensure sensitive data processed bythe virtual machine instance to generate the report is deleted.

31. The system of any of clauses 27 to 30, wherein the at least onecomputing device configured to implement one or more services, furthercomprises: instantiating a second virtual machine instance to monitor asecond set of transaction records for the account associated with thecustomer; determining whether an activity in the second set oftransaction records satisfy the set of conditions associated with thedestination; obtaining sensitive data associated with the activity inclear text form; and generating a second report to include the activitycomprising the sensitive data in clear text form.

32. The system of any of clauses 27 to 31, wherein the at least onecomputing device configured to implement one or more services, furthercomprises: sending the second report to the destination; and deletingthe second virtual machine instance after sending the report to ensuresensitive data processed by the second virtual machine instance togenerate the second report is deleted.

33. The system of any of clauses 27 to 32, wherein virtual machineinstance remains active proportional to the amount of time the report isgenerated.

34. The system of any of clauses 27 to 33, wherein the set of conditionsinclude information indicating a type of suspicious activity thatrequires a report to be generated.

35. A non-transitory computer-readable storage medium storing thereonexecutable instructions that, as a result of being executed by one ormore processors of a computer system, cause the computer system to atleast:

instantiate a virtual machine instance to satisfy a request to allow anentity to inspect a report including suspicious activity;

use the virtual machine instance to identify transaction records for anaccount associated with a customer;

determine whether an activity in the transaction records satisfy a setof conditions;

obtain sensitive data associated with the activity in clear text form;and

generate the report to include the activity comprising the sensitivedata in clear text form.

36. The non-transitory computer-readable storage medium of clause 35,wherein the virtual machine instance is instantiated with infrastructureand services to satisfy the request.

37. The non-transitory computer-readable storage medium of any ofclauses 35 or 36, wherein the virtual machine instance monitorstransaction records specific to the customer such that exposure islimited to the transaction records.

38. The non-transitory computer-readable storage medium of any ofclauses 35 to 37, wherein the instructions further comprise instructionsthat, as a result of being executed by the one or more processors, causethe computer system to: sending the report to a destination afterquerying the report including suspicious activity; and deleting thevirtual machine instance after sending the report to ensure sensitivedata processed by the virtual machine instance to generate the report isdeleted.

39. The non-transitory computer-readable storage medium of any ofclauses 35 to 38, wherein the instructions further comprise instructionsthat, as a result of being executed by the one or more processors, causethe computer system to: receive a task query request, at the virtualmachine instance, on a status of sending the report; send a notificationin response to the task query request; and delete the virtual machineinstance after sending the notification that the report is sent.

40. The non-transitory computer-readable storage medium of any ofclauses 35 to 39, wherein virtual machine instance remains activeproportional to the amount of time the report is generated.

41. The non-transitory computer-readable storage medium of any ofclauses 35 to 40, wherein the set of conditions include informationindicating a type of suspicious activity that requires a report to begenerated.

42. The non-transitory computer-readable storage medium of any ofclauses 35 to 41, wherein the instructions further comprise instructionsthat, as a result of being executed by the one or more processors, causethe computer system to instantiate a second virtual machine instance tomonitor a subset of the transaction records for the account associatedwith the customer to generate a second report while the first virtualmachine instance monitors the account.

The various embodiments further can be implemented in a wide variety ofoperating environments, which in some cases can include one or more usercomputers, computing devices or processing devices that can be used tooperate any of a number of applications. In an embodiment, user orclient devices include any of a number of computers, such as desktop,laptop or tablet computers running a standard operating system, as wellas cellular (mobile), wireless and handheld devices running mobilesoftware and capable of supporting a number of networking and messagingprotocols, and such a system also includes a number of workstationsrunning any of a variety of commercially available operating systems andother known applications for purposes such as development and databasemanagement. In an embodiment, these devices also include otherelectronic devices, such as dummy terminals, thin-clients, gamingsystems and other devices capable of communicating via a network, andvirtual devices such as virtual machines, hypervisors, softwarecontainers utilizing operating-system level virtualization and othervirtual devices or non-virtual devices supporting virtualization capableof communicating via a network.

In an embodiment, a system utilizes at least one network that would befamiliar to those skilled in the art for supporting communications usingany of a variety of commercially available protocols, such asTransmission Control Protocol/Internet Protocol (“TCP/IP”), UserDatagram Protocol (“UDP”), protocols operating in various layers of theOpen System Interconnection (“OSI”) model, File Transfer Protocol(“FTP”), Universal Plug and Play (“UpnP”), Network File System (“NFS”),Common Internet File System (“CIFS”) and other protocols. The network,in an embodiment, is a local area network, a wide-area network, avirtual private network, the Internet, an intranet, an extranet, apublic switched telephone network, an infrared network, a wirelessnetwork, a satellite network, and any combination thereof. In anembodiment, a connection-oriented protocol is used to communicatebetween network endpoints such that the connection-oriented protocol(sometimes called a connection-based protocol) is capable oftransmitting data in an ordered stream. In an embodiment, aconnection-oriented protocol can be reliable or unreliable. For example,the TCP protocol is a reliable connection-oriented protocol.Asynchronous Transfer Mode (“ATM”) and Frame Relay are unreliableconnection-oriented protocols. Connection-oriented protocols are incontrast to packet-oriented protocols such as UDP that transmit packetswithout a guaranteed ordering.

In an embodiment, the system utilizes a web server that runs one or moreof a variety of server or mid-tier applications, including HypertextTransfer Protocol (“HTTP”) servers, FTP servers, Common GatewayInterface (“CGP”) servers, data servers, Java servers, Apache servers,and business application servers. In an embodiment, the one or moreservers are also capable of executing programs or scripts in response torequests from user devices, such as by executing one or more webapplications that are implemented as one or more scripts or programswritten in any programming language, such as Java®, C, C# or C++, or anyscripting language, such as Ruby, PHP, Perl, Python or TCL, as well ascombinations thereof. In an embodiment, the one or more servers alsoinclude database servers, including without limitation thosecommercially available from Oracle®, Microsoft®, Sybase®, and IBM® aswell as open-source servers such as MySQL, Postgres, SQLite, MongoDB,and any other server capable of storing, retrieving, and accessingstructured or unstructured data. In an embodiment, a database serverincludes table-based servers, document-based servers, unstructuredservers, relational servers, non-relational servers, or combinations ofthese and/or other database servers.

In an embodiment, the system includes a variety of data stores and othermemory and storage media as discussed above that can reside in a varietyof locations, such as on a storage medium local to (and/or resident in)one or more of the computers or remote from any or all of the computersacross the network. In an embodiment, the information resides in astorage-area network (“SAN”) familiar to those skilled in the art and,similarly, any necessary files for performing the functions attributedto the computers, servers or other network devices are stored locallyand/or remotely, as appropriate. In an embodiment where a systemincludes computerized devices, each such device can include hardwareelements that are electrically coupled via a bus, the elementsincluding, for example, at least one central processing unit (“CPU” or“processor”), at least one input device (e.g., a mouse, keyboard,controller, touch screen, or keypad), at least one output device (e.g.,a display device, printer, or speaker), at least one storage device suchas disk drives, optical storage devices, and solid-state storage devicessuch as random access memory (“RAM”) or read-only memory (“ROM”), aswell as removable media devices, memory cards, flash cards, etc., andvarious combinations thereof.

In an embodiment, such a device also includes a computer-readablestorage media reader, a communications device (e.g., a modem, a networkcard (wireless or wired), an infrared communication device, etc.), andworking memory as described above where the computer-readable storagemedia reader is connected with, or configured to receive, acomputer-readable storage medium, representing remote, local, fixed,and/or removable storage devices as well as storage media fortemporarily and/or more permanently containing, storing, transmitting,and retrieving computer-readable information. In an embodiment, thesystem and various devices also typically include a number of softwareapplications, modules, services, or other elements located within atleast one working memory device, including an operating system andapplication programs, such as a client application or web browser. In anembodiment, customized hardware is used and/or particular elements areimplemented in hardware, software (including portable software, such asapplets), or both. In an embodiment, connections to other computingdevices such as network input/output devices are employed.

In an embodiment, storage media and computer readable media forcontaining code, or portions of code, include any appropriate mediaknown or used in the art, including storage media and communicationmedia, such as but not limited to volatile and non-volatile, removableand non-removable media implemented in any method or technology forstorage and/or transmission of information such as computer readableinstructions, data structures, program modules or other data, includingRAM, ROM, Electrically Erasable Programmable Read-Only Memory(“EEPROM”), flash memory or other memory technology, Compact DiscRead-Only Memory (“CD-ROM”), digital versatile disk (DVD) or otheroptical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices or any other medium which canbe used to store the desired information and which can be accessed bythe system device. Based on the disclosure and teachings providedherein, a person of ordinary skill in the art will appreciate other waysand/or methods to implement the various embodiments.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. It will, however, beevident that various modifications and changes may be made thereuntowithout departing from the broader spirit and scope of the invention asset forth in the claims.

Other variations are within the spirit of the present disclosure. Thus,while the disclosed techniques are susceptible to various modificationsand alternative constructions, certain illustrated embodiments thereofare shown in the drawings and have been described above in detail. Itshould be understood, however, that there is no intention to limit theinvention to the specific form or forms disclosed but, on the contrary,the intention is to cover all modifications, alternative constructions,and equivalents falling within the spirit and scope of the invention, asdefined in the appended claims.

The use of the terms “a” and “an” and “the” and similar referents in thecontext of describing the disclosed embodiments (especially in thecontext of the following claims) are to be construed to cover both thesingular and the plural, unless otherwise indicated herein or clearlycontradicted by context. Similarly, use of the term “or” is to beconstrued to mean “and/or” unless contradicted explicitly or by context.The terms “comprising,” “having,” “including,” and “containing” are tobe construed as open-ended terms (i.e., meaning “including, but notlimited to,”) unless otherwise noted. The term “connected,” whenunmodified and referring to physical connections, is to be construed aspartly or wholly contained within, attached to, or joined together, evenif there is something intervening. Recitation of ranges of values hereinare merely intended to serve as a shorthand method of referringindividually to each separate value falling within the range, unlessotherwise indicated herein, and each separate value is incorporated intothe specification as if it were individually recited herein. The use ofthe term “set” (e.g., “a set of items”) or “subset” unless otherwisenoted or contradicted by context, is to be construed as a nonemptycollection comprising one or more members. Further, unless otherwisenoted or contradicted by context, the term “subset” of a correspondingset does not necessarily denote a proper subset of the correspondingset, but the subset and the corresponding set may be equal. The use ofthe phrase “based on,” unless otherwise explicitly stated or clear fromcontext, means “based at least in part on” and is not limited to “basedsolely on.”

Conjunctive language, such as phrases of the form “at least one of A, B,and C,” or “at least one of A, B and C,” (i.e., the same phrase with orwithout the Oxford comma) unless specifically stated otherwise orotherwise clearly contradicted by context, is otherwise understoodwithin the context as used in general to present that an item, term,etc., may be either A or B or C, any nonempty subset of the set of A andB and C, or any set not contradicted by context or otherwise excludedthat contains at least one A, at least one B, or at least one C. Forinstance, in the illustrative example of a set having three members, theconjunctive phrases “at least one of A, B, and C” and “at least one ofA, B and C” refer to any of the following sets: {A}, {B}, {C}, {A, B},{A, C}, {B, C}, {A, B, C}, and, if not contradicted explicitly or bycontext, any set having {A}, {B}, and/or {C} as a subset (e.g., setswith multiple “A”). Thus, such conjunctive language is not generallyintended to imply that certain embodiments require at least one of A, atleast one of B and at least one of C each to be present. Similarly,phrases such as “at least one of A, B, or C” and “at least one of A, Bor C” refer to the same as “at least one of A, B, and C” and “at leastone of A, B and C” refer to any of the following sets: {A}, {B}, {C},{A, B}, {A, C}, {B, C}, {A, B, C}, unless differing meaning isexplicitly stated or clear from context. In addition, unless otherwisenoted or contradicted by context, the term “plurality” indicates a stateof being plural (e.g., “a plurality of items” indicates multiple items).The number of items in a plurality is at least two but can be more whenso indicated either explicitly or by context.

Operations of processes described herein can be performed in anysuitable order unless otherwise indicated herein or otherwise clearlycontradicted by context. In an embodiment, a process such as thoseprocesses described herein (or variations and/or combinations thereof)is performed under the control of one or more computer systemsconfigured with executable instructions and is implemented as code(e.g., executable instructions, one or more computer programs or one ormore applications) executing collectively on one or more processors, byhardware or combinations thereof. In an embodiment, the code is storedon a computer-readable storage medium, for example, in the form of acomputer program comprising a plurality of instructions executable byone or more processors. In an embodiment, a computer-readable storagemedium is a non-transitory computer-readable storage medium thatexcludes transitory signals (e.g., a propagating transient electric orelectromagnetic transmission) but includes non-transitory data storagecircuitry (e.g., buffers, cache, and queues) within transceivers oftransitory signals. In an embodiment, code (e.g., executable code orsource code) is stored on a set of one or more non-transitorycomputer-readable storage media having stored thereon executableinstructions that, when executed (i.e., as a result of being executed)by one or more processors of a computer system, cause the computersystem to perform operations described herein. The set of non-transitorycomputer-readable storage media, in an embodiment, comprises multiplenon-transitory computer-readable storage media, and one or more ofindividual non-transitory storage media of the multiple non-transitorycomputer-readable storage media lack all of the code while the multiplenon-transitory computer-readable storage media collectively store all ofthe code. In an embodiment, the executable instructions are executedsuch that different instructions are executed by differentprocessors—for example, in an embodiment, a non-transitorycomputer-readable storage medium stores instructions and a main CPUexecutes some of the instructions while a graphics processor unitexecutes other instructions. In another embodiment, different componentsof a computer system have separate processors and different processorsexecute different subsets of the instructions.

Accordingly, in an embodiment, computer systems are configured toimplement one or more services that singly or collectively performoperations of processes described herein, and such computer systems areconfigured with applicable hardware and/or software that enable theperformance of the operations. Further, a computer system, in anembodiment of the present disclosure, is a single device and, in anotherembodiment, is a distributed computer system comprising multiple devicesthat operate differently such that the distributed computer systemperforms the operations described herein and such that a single devicedoes not perform all operations.

The use of any and all examples or exemplary language (e.g., “such as”)provided herein is intended merely to better illuminate embodiments ofthe invention and does not pose a limitation on the scope of theinvention unless otherwise claimed. No language in the specificationshould be construed as indicating any non-claimed element as essentialto the practice of the invention.

Embodiments of this disclosure are described herein, including the bestmode known to the inventors for carrying out the invention. Variationsof those embodiments may become apparent to those of ordinary skill inthe art upon reading the foregoing description. The inventors expectskilled artisans to employ such variations as appropriate, and theinventors intend for embodiments of the present disclosure to bepracticed otherwise than as specifically described herein. Accordingly,the scope of the present disclosure includes all modifications andequivalents of the subject matter recited in the claims appended heretoas permitted by applicable law. Moreover, any combination of theabove-described elements in all possible variations thereof isencompassed by the scope of the present disclosure unless otherwiseindicated herein or otherwise clearly contradicted by context.

All references including publications, patent applications, and patentscited herein are hereby incorporated by reference to the same extent asif each reference were individually and specifically indicated to beincorporated by reference and were set forth in its entirety herein.

What is claimed is:
 1. A computer-implemented method, comprising:receiving a request to identify one or more accounts comprisingsensitive data, wherein the one or more accounts are associated with acustomer of a computing resource service provider; selecting a virtualmachine instance to obtain information from the one or more accounts;identifying an abnormality with transactions associated with the one ormore accounts; providing a subset of the sensitive data, as a result ofidentifying the abnormality, to a service in exchange for the subset ofthe sensitive data in clear text form; using the virtual machineinstance to generate a report to allow for visual inspection by anentity, wherein the report includes information indicating theabnormality with the transactions, the sensitive data, and the subset ofthe sensitive data in clear text form; and deleting the virtual machineinstance in response to completing the visual inspection.
 2. Thecomputer-implemented method of claim 1, wherein the virtual machineinstance is selected, by the entity, from a pool of virtual machineinstances.
 3. The computer-implemented method of claim 1, wherein thevirtual machine instance remains active for an amount of time that isproportional to a completion time of inspecting the report.
 4. Thecomputer-implemented method of claim 1, wherein identifying anabnormality with transactions associated with the one or more accountsfurther comprises monitoring a website for transaction recordsassociated with the website.
 5. A system, comprising: at least onecomputing device configured to implement one or more services, whereinthe one or more services: instantiate a virtual machine instance tosatisfy a request to query a report including suspicious activityassociated with a destination; use the virtual machine instance toidentify transaction records for an account associated with a customer;determine whether an activity in the transaction records satisfy a setof conditions associated with the destination; obtain sensitive dataassociated with the activity in clear text form; and generate the reportto include the activity comprising the sensitive data in clear textform.
 6. The system of claim 5, wherein the virtual machine instance isinstantiated with infrastructure and services to satisfy the request toquery the report.
 7. The system of claim 5, wherein the virtual machineinstance monitors transaction records specific to the customer such thatexposure is limited to the transaction records.
 8. The system of claim5, wherein the at least one computing device configured to implement oneor more services, further comprises: sending the report to thedestination to after querying the report for suspicious activity; anddeleting the virtual machine instance after sending the report to ensuresensitive data processed by the virtual machine instance to generate thereport is deleted.
 9. The system of claim 5, wherein the at least onecomputing device configured to implement one or more services, furthercomprises: instantiating a second virtual machine instance to monitor asecond set of transaction records for the account associated with thecustomer; determining whether an activity in the second set oftransaction records satisfy the set of conditions associated with thedestination; obtaining sensitive data associated with the activity inclear text form; and generating a second report to include the activitycomprising the sensitive data in clear text form.
 10. The system ofclaim 9, wherein the at least one computing device configured toimplement one or more services, further comprises: sending the secondreport to the destination; and deleting the second virtual machineinstance after sending the report to ensure sensitive data processed bythe second virtual machine instance to generate the second report isdeleted.
 11. The system of claim 5, wherein virtual machine instanceremains active proportional to the amount of time the report isgenerated.
 12. The system of claim 5, wherein the set of conditionsinclude information indicating a type of suspicious activity thatrequires a report to be generated.
 13. A non-transitorycomputer-readable storage medium storing thereon executable instructionsthat, as a result of being executed by one or more processors of acomputer system, cause the computer system to at least: instantiate avirtual machine instance to satisfy a request to allow an entity toinspect a report including suspicious activity; use the virtual machineinstance to identify transaction records for an account associated witha customer; determine whether an activity in the transaction recordssatisfy a set of conditions; obtain sensitive data associated with theactivity in clear text form; and generate the report to include theactivity comprising the sensitive data in clear text form.
 14. Thenon-transitory computer-readable storage medium of claim 13, wherein thevirtual machine instance is instantiated with infrastructure andservices to satisfy the request.
 15. The non-transitorycomputer-readable storage medium of claim 13, wherein the virtualmachine instance monitors transaction records specific to the customersuch that exposure is limited to the transaction records.
 16. Thenon-transitory computer-readable storage medium of claim 13, wherein theinstructions further comprise instructions that, as a result of beingexecuted by the one or more processors, cause the computer system to:sending the report to a destination after querying the report includingsuspicious activity; and deleting the virtual machine instance aftersending the report to ensure sensitive data processed by the virtualmachine instance to generate the report is deleted.
 17. Thenon-transitory computer-readable storage medium of claim 16, wherein theinstructions further comprise instructions that, as a result of beingexecuted by the one or more processors, cause the computer system to:receive a task query request, at the virtual machine instance, on astatus of sending the report; send a notification in response to thetask query request; and delete the virtual machine instance aftersending the notification that the report is sent.
 18. The non-transitorycomputer-readable storage medium of claim 13, wherein virtual machineinstance remains active proportional to the amount of time the report isgenerated.
 19. The non-transitory computer-readable storage medium ofclaim 13, wherein the set of conditions include information indicating atype of suspicious activity that requires a report to be generated. 20.The non-transitory computer-readable storage medium of claim 13, whereinthe instructions further comprise instructions that, as a result ofbeing executed by the one or more processors, cause the computer systemto instantiate a second virtual machine instance to monitor a subset ofthe transaction records for the account associated with the customer togenerate a second report while the first virtual machine instancemonitors the account.